Let’s find out the list of SCCM status message queries. There are 43 default queries available in the latest SCCM Current Branch release. I have also shared a Custom Query for SCCM Task Sequence Engine Status Messages.
I have also shared the simple method to create and run a simple SCCM custom status message query. Most used SCCM status message queries are related to audit status messages. Various status message queries are available to find out who deleted and modified server components in SCCM.
You can also check the list of SCCM status message queries from SQL Server Management Studio. SCCM Status messages are very helpful to troubleshoot deployment and component installation issues.
The following are some examples of Audit status messages and SQL queries where you can find the details. This information can be used to track/audit the changes in Configuration Manager infrastructure initiated by admins.
- Who deleted the SCCM collection?
- SCCM Audit Reports Who Initiated CMPivot Query | ConfigMgr
- Who Deleted ConfigMgr Task Sequence | Modified |Created | SCCM
Custom Query for SCCM Task Sequence Engine Status Messages
Let’s see how to create custom SCCM status message queries in this section of the post. It’s a pretty simple process if you know the details, such as component details, process ID, Status ID, etc.
Navigate to \Monitoring\Overview\System Status\Status Message Queries from the SCCM admin console to create the custom status message query.
- Click on Create Status Message Query button from the ribbon menu.
It’s time to enter the details of the custom query
- Enter the Name of the Status Message Query – TS Engine Status Message.
- Enter the Comment for the SCCM Status Message Query -> Status Message Query for TS Engine Status. To get information on Task Sequence Engine Alerts for devices.
- Click on the Edit Query Statement button.
Click on the Show Query Language button from the General tab in the new window.
You need to copy the following WQL query to Create Custom SCCM Status Message Queries for Task Sequence Engine Status Message. This query prompts you to select the time frame you want to cover.
select stat.*, ins.*, att1.*, stat.Time from SMS_StatusMessage as stat left join SMS_StatMsgInsStrings as ins on ins.RecordID = stat.RecordID left join SMS_StatMsgAttributes as att1 on att1.RecordID = stat.RecordID where stat.Component = "Task Sequence Engine" and stat.Time >= ##PRM:SMS_StatusMessage.Time## order by stat.Time DESCClick on the OK button to continue. Click on the Next button from the summary page and the Close button to finish the custom SCCM Status Message Queries for Task Sequence Engine.
Results of the custom SCCM Status message query SCCM Task Sequence Engine Status Messages provide very useful information for troubleshooting scenarios.
SQL Queries for SCCM Status Messages
Let’s SQL Queries related to SCCM Status Messages. You need to follow the steps mentioned below to get the list from SSMS.
- Open the SQL Server Management Studio (aka SSMS).
- Connect your Database Engine.
- Right Click on your database CM_XXX and click on ‘New Query.’
- Copy the following SQL query to find the report list of SCCM Status Message Queries.
- Click on the Execute button.
select all SMS_Query.QueryKey,SMS_Query.Name,SMS_Query.WQL,SMS_Query.Comments from Queries AS SMS_Query
Let’s check the SCCM status messages from the SQL Database.
select * from vStatusMessages
All SCCM Status Message Queries
This section talks about All SCCM Status Message Queries. This includes audit status messages and all status messages for specific sites and collections. I like the All Status Messages query. This helps to analyze and understand the particular status messages and create custom queries.
Navigate to \Monitoring\Overview\System Status\Status Message Queries from the SCCM admin console to check the default list of SCCM SCCM status queries.
| All Audit Status Messages for a Specific User | Audit status messages that track activity initiated by a specific user (when prompted, use the form DOMAIN\username). | select stat.*, ins.*, att1.*, att1.AttributeTime from SMS_StatusMessage as stat left join SMS_StatMsgInsStrings as ins on stat.RecordID = ins.RecordID left join SMS_StatMsgAttributes as att1 on stat.RecordID = att1.RecordID inner join SMS_StatMsgAttributes as att2 on stat.RecordID = att2.RecordID where stat.MessageType = 768 and att2.AttributeID = 403 and att2.AttributeValue = ##PRM:SMS_StatMsgAttributes.AttributeValue## and att2.AttributeTime >= ##PRM:SMS_StatMsgAttributes.AttributeTime## order by att1.AttributeTime desc |
| All Audit Status Messages from a Specific Site | Audit status messages are reported at a specific site. | select stat.*, ins.*, att1.*, stat.Time from SMS_StatusMessage as stat left join SMS_StatMsgInsStrings as ins on stat.RecordID = ins.RecordID left join SMS_StatMsgAttributes as att1 on stat.RecordID = att1.RecordID where stat.MessageType = 768 and stat.SiteCode = ##PRM:SMS_StatusMessage.SiteCode## and stat.Time >= ##PRM:SMS_StatusMessage.Time## order by stat.Time desc |
| All Status Messages | Status messages reported after a specific date and time. | select stat.*, ins.*, att1.*, stat.Time from SMS_StatMsg as stat left join SMS_StatInsStr as ins on stat.RecordID = ins.RecordID left join SMS_StatAttr as att1 on stat.RecordID = att1.RecordID where stat.Time >= ##PRM:SMS_StatusMessage.Time## order by stat.Time desc |
| All Status Messages for a Specific Collection at a Specific Site | Status messages reported for a specific collection at a specific site. | select stat.*, ins.*, att1.*, att1.AttributeTime from SMS_StatusMessage as stat left join SMS_StatMsgInsStrings as ins on stat.RecordID = ins.RecordID left join SMS_StatMsgAttributes as att1 on stat.RecordID = att1.RecordID inner join SMS_StatMsgAttributes as att2 on stat.RecordID = att2.RecordID where att2.AttributeID = 402 and att2.AttributeValue = ##PRM:SMS_StatMsgAttributes.AttributeValue## and stat.SiteCode = ##PRM:SMS_StatusMessage.SiteCode## and att2.AttributeTime >= ##PRM:SMS_StatMsgAttributes.AttributeTime## order by att1.AttributeTime desc |
| All Status Messages for a Specific Deployment at a Specific Site | Status messages are reported for a specific deployment at a specific site. | select stat.*, ins.*, att1.*, att1.AttributeTime from SMS_StatusMessage as stat left join SMS_StatMsgInsStrings as ins on stat.RecordID = ins.RecordID left join SMS_StatMsgAttributes as att1 on stat.RecordID = att1.RecordID inner join SMS_StatMsgAttributes as att2 on stat.RecordID = att2.RecordID where att2.AttributeID = 401 and att2.AttributeValue = ##PRM:SMS_StatMsgAttributes.AttributeValue## and stat.SiteCode = ##PRM:SMS_StatusMessage.SiteCode## and att2.AttributeTime >= ##PRM:SMS_StatMsgAttributes.AttributeTime## order by att1.AttributeTime desc |
| All Status Messages for a Specific Package at a Specific Site | Status messages are reported for a specific package at a specific site. | select stat.*, ins.*, att1.*, att1.AttributeTime from SMS_StatusMessage as stat left join SMS_StatMsgInsStrings as ins on stat.RecordID = ins.RecordID left join SMS_StatMsgAttributes as att1 on stat.RecordID = att1.RecordID inner join SMS_StatMsgAttributes as att2 on stat.RecordID = att2.RecordID where att2.AttributeID = 400 and att2.AttributeValue = ##PRM:SMS_StatMsgAttributes.AttributeValue## and stat.SiteCode = ##PRM:SMS_StatusMessage.SiteCode## and att2.AttributeTime >= ##PRM:SMS_StatMsgAttributes.AttributeTime## order by att1.AttributeTime desc |
| All Status Messages from a Specific Component at a Specific Site | Status messages are reported by a specific component at a specific site. | select stat.*, ins.*, att1.*, stat.Time from SMS_StatusMessage as stat left join SMS_StatMsgInsStrings as ins on stat.RecordID = ins.RecordID left join SMS_StatMsgAttributes as att1 on stat.RecordID = att1.RecordID where stat.Component = ##PRM:SMS_StatusMessage.Component## and stat.SiteCode = ##PRM:SMS_StatusMessage.SiteCode## and stat.Time >= ##PRM:SMS_StatusMessage.Time## order by stat.Time desc |
| All Status Messages from a Specific Component on a Specific System | Status messages are reported by a specific component running on a specific system. | select stat.*, ins.*, att1.*, stat.Time from SMS_StatusMessage as stat left join SMS_StatMsgInsStrings as ins on stat.RecordID = ins.RecordID left join SMS_StatMsgAttributes as att1 on stat.RecordID = att1.RecordID where stat.Component = ##PRM:SMS_StatusMessage.Component## and stat.MachineName = ##PRM:SMS_StatusMessage.MachineName## and stat.Time >= ##PRM:SMS_StatusMessage.Time## order by stat.Time desc |
| All Status Messages from a Specific Site | Status messages reported at a specific site. | select stat.*, ins.*, att1.*, stat.Time from SMS_StatusMessage as stat left join SMS_StatMsgInsStrings as ins on stat.RecordID = ins.RecordID left join SMS_StatMsgAttributes as att1 on stat.RecordID = att1.RecordID where stat.SiteCode = ##PRM:SMS_StatusMessage.SiteCode## and stat.Time >= ##PRM:SMS_StatusMessage.Time## order by stat.Time desc |
| All Status Messages from a Specific System | Status messages reported by a specific system. | select stat.*, ins.*, att1.*, stat.Time from SMS_StatusMessage as stat left join SMS_StatMsgInsStrings as ins on stat.RecordID = ins.RecordID left join SMS_StatMsgAttributes as att1 on stat.RecordID = att1.RecordID where stat.MachineName = ##PRM:SMS_StatusMessage.MachineName## and stat.Time >= ##PRM:SMS_StatusMessage.Time## order by stat.Time desc |
| All Status Messages of a Specific Severity from a Specific Source at a Specific Site | Status messages of a specific severity reported by a specific source at a specific site. | select stat.*, ins.*, att1.*, stat.Time from SMS_StatusMessage as stat left join SMS_StatMsgInsStrings as ins on stat.RecordID = ins.RecordID left join SMS_StatMsgAttributes as att1 on stat.RecordID = att1.RecordID where stat.Severity = ##PRM:SMS_StatusMessage.Severity## and stat.ModuleName = ##PRM:SMS_StatusMessage.ModuleName## and stat.SiteCode = ##PRM:SMS_StatusMessage.SiteCode## and stat.Time >= ##PRM:SMS_StatusMessage.Time## order by stat.Time desc |
SCCM Client Related Status Message Queries
Let’s check the list of SCCM Client Related Status Message Queries available in SCCM as an out of the box solution. There are 13 Status message queries in the below table.
You can use the following queries to create custom queries as per your requirement. This process is already explained in the above section of this post.
You can navigate to \Monitoring\Overview\System Status\Status Message Queries from the SCCM admin console to check the default list of SCCM status queries related to the client status messages.
| Client Component Configuration Changes | Audit status messages that track changes to the client components” configuration are kept in the site control file. | select stat.*, ins.*, att1.*, stat.Time from SMS_StatusMessage as stat left join SMS_StatMsgInsStrings as ins on stat.RecordID = ins.RecordID left join SMS_StatMsgAttributes as att1 on stat.RecordID = att1.RecordID where stat.MessageType = 768 and stat.MessageID >= 30042 and stat.MessageID <= 30047 and stat.Time >= ##PRM:SMS_StatusMessage.Time## order by stat.Time desc |
| Client Components Experiencing Fatal Errors | Status messages are reported by the ConfigMgr Client components when they experience fatal errors. | select stat.*, ins.*, att1.*, stat.Time from SMS_StatusMessage as stat left join SMS_StatMsgInsStrings as ins on stat.RecordID = ins.RecordID left join SMS_StatMsgAttributes as att1 on stat.RecordID = att1.RecordID where stat.ModuleName = ‘SMS Client’ and stat.MessageID = 669 and stat.SiteCode = ##PRM:SMS_StatusMessage.SiteCode## and stat.Time >= ##PRM:SMS_StatusMessage.Time## order by stat.Time desc |
| Client Configuration Requests (CCRs) Processed Unsuccessfully | Status messages are reported by the SMS Client Configuration Manager when it fails to process a client configuration request (CCR). | select stat.*, ins.*, att1.*, stat.Time from SMS_StatusMessage as stat left join SMS_StatMsgInsStrings as ins on stat.RecordID = ins.RecordID left join SMS_StatMsgAttributes as att1 on stat.RecordID = att1.RecordID where stat.Component = ‘SMS_CLIENT_CONFIG_MANAGER’ and stat.MessageID >= 3010 and stat.MessageID <= 3011 and stat.SiteCode = ##PRM:SMS_StatusMessage.SiteCode## and stat.Time >= ##PRM:SMS_StatusMessage.Time## order by stat.Time desc |
| Clients Assigned to or Unassigned from a Specific Site | Status messages reported by the ConfigMgr Cli. Comp. Instl. Mgr. on client assignment to or unassignment from a site. | select stat.*, ins.*, att1.*, stat.Time from SMS_StatusMessage as stat left join SMS_StatMsgInsStrings as ins on stat.RecordID = ins.RecordID left join SMS_StatMsgAttributes as att1 on stat.RecordID = att1.RecordID where stat.Component = ‘Client Component Installation Manager’ and stat.MessageID >= 10202 and stat.MessageID <= 10203 and stat.SiteCode = ##PRM:SMS_StatusMessage.SiteCode## and stat.Time >= ##PRM:SMS_StatusMessage.Time## order by stat.Time desc |
| Clients That Failed to Run a Specific Deployed Program Successfully | Status messages are reported by the Available Programs Manager when a specific deployed program runs and completes unsuccessfully. | select stat.*, ins.*, att1.*, att1.AttributeTime from SMS_StatusMessage as stat left join SMS_StatMsgInsStrings as ins on stat.RecordID = ins.RecordID left join SMS_StatMsgAttributes as att1 on stat.RecordID = att1.RecordID inner join SMS_StatMsgAttributes as att2 on stat.RecordID = att2.RecordID where stat.ModuleName = ‘SMS Client’ and stat.MessageID >= 10006 and stat.MessageID <= 10007 and att2.AttributeID = 401 and att2.AttributeValue = ##PRM:SMS_StatMsgAttributes.AttributeValue## and stat.SiteCode = ##PRM:SMS_StatusMessage.SiteCode## and att2.AttributeTime >= ##PRM:SMS_StatMsgAttributes.AttributeTime## order by att1.AttributeTime desc |
| Clients That Failed to Start a Specific Deployed Program | Status messages are reported by the Available Programs Manager when it fails to start a specific advertised program. | select stat.*, ins.*, att1.*, att1.AttributeTime from SMS_StatusMessage as stat left join SMS_StatMsgInsStrings as ins on stat.RecordID = ins.RecordID left join SMS_StatMsgAttributes as att1 on stat.RecordID = att1.RecordID inner join SMS_StatMsgAttributes as att2 on stat.RecordID = att2.RecordID where stat.ModuleName = ‘SMS Client’ and (stat.MessageID = 10000 or stat.MessageID = 10001 or stat.MessageID = 10003 or stat.MessageID = 10004 or stat.MessageID = 10021) and att2.AttributeID = 401 and att2.AttributeValue = ##PRM:SMS_StatMsgAttributes.AttributeValue## and stat.SiteCode = ##PRM:SMS_StatusMessage.SiteCode## and att2.AttributeTime >= ##PRM:SMS_StatMsgAttributes.AttributeTime## order by att1.AttributeTime desc |
| Clients That Ran a Specific Deployed Program Successfully | Status messages are reported by the Available Programs Manager when a specific advertised program runs and completes successfully. | select stat.*, ins.*, att1.*, att1.AttributeTime from SMS_StatusMessage as stat left join SMS_StatMsgInsStrings as ins on stat.RecordID = ins.RecordID left join SMS_StatMsgAttributes as att1 on stat.RecordID = att1.RecordID inner join SMS_StatMsgAttributes as att2 on stat.RecordID = att2.RecordID where stat.ModuleName = ‘SMS Client’ and stat.MessageID >= 10008 and stat.MessageID <= 10009 and att2.AttributeID = 401 and att2.AttributeValue = ##PRM:SMS_StatMsgAttributes.AttributeValue## and stat.SiteCode = ##PRM:SMS_StatusMessage.SiteCode## and att2.AttributeTime >= ##PRM:SMS_StatMsgAttributes.AttributeTime## order by att1.AttributeTime desc |
| Clients That Received a Specific Deployed Program | Status messages are reported by the Available Programs Manager when it receives a specific advertised program. | select stat.*, ins.*, att1.*, att1.AttributeTime from SMS_StatusMessage as stat left join SMS_StatMsgInsStrings as ins on stat.RecordID = ins.RecordID left join SMS_StatMsgAttributes as att1 on stat.RecordID = att1.RecordID inner join SMS_StatMsgAttributes as att2 on stat.RecordID = att2.RecordID where stat.ModuleName = ‘SMS Client’ and stat.MessageID = 10002 and att2.AttributeID = 401 and att2.AttributeValue = ##PRM:SMS_StatMsgAttributes.AttributeValue## and stat.SiteCode = ##PRM:SMS_StatusMessage.SiteCode## and att2.AttributeTime >= ##PRM:SMS_StatMsgAttributes.AttributeTime## order by att1.AttributeTime desc |
| Clients That Rejected a Specific Deployed Program | Status messages are reported by the Available Programs Manager when it receives and rejects a specific advertised program. | select stat.*, ins.*, att1.*, att1.AttributeTime from SMS_StatusMessage as stat left join SMS_StatMsgInsStrings as ins on stat.RecordID = ins.RecordID left join SMS_StatMsgAttributes as att1 on stat.RecordID = att1.RecordID inner join SMS_StatMsgAttributes as att2 on stat.RecordID = att2.RecordID where stat.ModuleName = ‘SMS Client’ and stat.MessageID >= 10018 and stat.MessageID <=10019 and att2.AttributeID = 401 and att2.AttributeValue = ##PRM:SMS_StatMsgAttributes.AttributeValue## and stat.SiteCode = ##PRM:SMS_StatusMessage.SiteCode## and att2.AttributeTime >= ##PRM:SMS_StatMsgAttributes.AttributeTime## order by att1.AttributeTime desc |
| Clients That Reported Errors or Warnings During Inventory File Collection | Error and warning status messages are generated by the Software Inventory, Hardware Inventory, or File Collection Agents when they attempt to collect files on clients. | select stat.*, ins.*, att1.*, stat.Time from SMS_StatusMessage as stat left join SMS_StatMsgInsStrings as ins on stat.RecordID = ins.RecordID left join SMS_StatMsgAttributes as att1 on stat.RecordID = att1.RecordID where (stat.MessageID=10651 or stat.MessageID=10602 or stat.MessageID=10603 or stat.MessageID=10508 or stat.MessageID=10509 or stat.MessageID=10510 or (stat.Component = ‘File Collection Agent’ and stat.Severity <> 1073741824)) and stat.SiteCode = ##PRM:SMS_StatusMessage.SiteCode## and stat.Time >= ##PRM:SMS_StatusMessage.Time## order by stat.Time desc |
| Clients That Reported Errors or Warnings While Creating a Hardware Inventory File | Error and warning status messages were generated by the Hardware Inventory Agent when it attempted to report a hardware inventory file. | select stat.*, ins.*, att1.*, stat.Time from SMS_StatusMessage as stat left join SMS_StatMsgInsStrings as ins on stat.RecordID = ins.RecordID left join SMS_StatMsgAttributes as att1 on stat.RecordID = att1.RecordID where (stat.Component=’Hardware Inventory Agent’ and stat.Severity<>1073741824) and stat.MessageID<>10508 and stat.MessageID<>10509 and stat.MessageID<>10510 and stat.SiteCode = ##PRM:SMS_StatusMessage.SiteCode## and stat.Time >= ##PRM:SMS_StatusMessage.Time## order by stat.Time desc |
| Clients That Reported Errors or Warnings While Creating a Software Inventory File | Error and warning status messages were generated by the Software Inventory Agent when it attempted to report a software inventory file. | select stat.*, ins.*, att1.*, stat.Time from SMS_StatusMessage as stat left join SMS_StatMsgInsStrings as ins on stat.RecordID = ins.RecordID left join SMS_StatMsgAttributes as att1 on stat.RecordID = att1.RecordID where (stat.Component=’Software Inventory Agent’ and stat.Severity<>1073741824) and stat.MessageID<>10602 and stat.MessageID<>10603 and stat.MessageID<>10651 and stat.SiteCode = ##PRM:SMS_StatusMessage.SiteCode## and stat.Time >= ##PRM:SMS_StatusMessage.Time## order by stat.Time desc |
| Clients That Started a Specific Deployed Program | Status messages are reported by the Available Programs Manager when it starts running. | select stat.*, ins.*, att1.*, att1.AttributeTime from SMS_StatusMessage as stat left join SMS_StatMsgInsStrings as ins on stat.RecordID = ins.RecordID left join SMS_StatMsgAttributes as att1 on stat.RecordID = att1.RecordID inner join SMS_StatMsgAttributes as att2 on stat.RecordID = att2.RecordID where stat.ModuleName = ‘SMS Client’ and stat.MessageID = 10005 and att2.AttributeID = 401 and att2.AttributeValue = ##PRM:SMS_StatMsgAttributes.AttributeValue## and stat.SiteCode = ##PRM:SMS_StatusMessage.SiteCode## and att2.AttributeTime >= ##PRM:SMS_StatMsgAttributes.AttributeTime## order by att1.AttributeTime desc |
Specific Audit Status Message Queries from SCCM
Let’s see what are Specific Audit Status Message queries available on SCCM Status Message Queries. These queries help understand who deleted collection, application, task sequence, etc.
Navigate to \Monitoring\Overview\System Status\Status Message Queries to check the details of each audit status message query.
| Boundaries Created, Modified, or Deleted | Audit status messages that track the creation, modification, and deletion of boundaries. | select stat.*, ins.*, att1.*, stat.Time from SMS_StatusMessage as stat left join SMS_StatMsgInsStrings as ins on stat.RecordID = ins.RecordID left join SMS_StatMsgAttributes as att1 on stat.RecordID = att1.RecordID where stat.MessageType = 768 and stat.MessageID >= 40600 and stat.MessageID <= 40602 and stat.Time >= ##PRM:SMS_StatusMessage.Time## order by stat.Time desc |
| Collection Member Resources Manually Deleted | Audit status messages that track the manual deletion of collection member resources by an administrator. | select stat.*, ins.*, att1.*, stat.Time from SMS_StatusMessage as stat left join SMS_StatMsgInsStrings as ins on stat.RecordID = ins.RecordID left join SMS_StatMsgAttributes as att1 on stat.RecordID = att1.RecordID where stat.MessageType = 768 and stat.MessageID >= 30066 and stat.MessageID <= 30067 and stat.Time >= ##PRM:SMS_StatusMessage.Time## order by stat.Time desc |
| Collections Created, Modified, or Deleted | Audit status messages that track the creation, modification, and deletion of collections. | select stat.*, ins.*, att1.*, stat.Time from SMS_StatusMessage as stat left join SMS_StatMsgInsStrings as ins on stat.RecordID = ins.RecordID left join SMS_StatMsgAttributes as att1 on stat.RecordID = att1.RecordID where stat.MessageType = 768 and stat.MessageID >= 30015 and stat.MessageID <= 30017 and stat.Time >= ##PRM:SMS_StatusMessage.Time## order by stat.Time desc |
| Deployments Created, Modified, or Deleted | Audit status messages that track the creation, modification, and deletion of deployments. | select stat.*, ins.*, att1.*, stat.Time from SMS_StatusMessage as stat left join SMS_StatMsgInsStrings as ins on stat.RecordID = ins.RecordID left join SMS_StatMsgAttributes as att1 on stat.RecordID = att1.RecordID where stat.MessageType = 768 and stat.MessageID >= 30006 and stat.MessageID <= 30008 and stat.Time >= ##PRM:SMS_StatusMessage.Time## order by stat.Time desc |
| Packages Created, Modified, or Deleted | Audit status messages that track the creation, modification, and deletion of packages | select stat.*, ins.*, att1.*, stat.Time from SMS_StatusMessage as stat left join SMS_StatMsgInsStrings as ins on stat.RecordID = ins.RecordID left join SMS_StatMsgAttributes as att1 on stat.RecordID = att1.RecordID where stat.MessageType = 768 and stat.MessageID >= 30000 and stat.MessageID <= 30002 and stat.Time >= ##PRM:SMS_StatusMessage.Time## order by stat.Time desc |
| Programs Created, Modified, or Deleted | Audit status messages that track the creation, modification, and deletion of package programs. | select stat.*, ins.*, att1.*, stat.Time from SMS_StatusMessage as stat left join SMS_StatMsgInsStrings as ins on stat.RecordID = ins.RecordID left join SMS_StatMsgAttributes as att1 on stat.RecordID = att1.RecordID where stat.MessageType = 768 and stat.MessageID >= 30003 and stat.MessageID <= 30005 and stat.Time >= ##PRM:SMS_StatusMessage.Time## order by stat.Time desc |
| Queries Created, Modified, or Deleted | Audit status messages that track the creation, modification, and deletion of queries, including status message queries. | select stat.*, ins.*, att1.*, stat.Time from SMS_StatusMessage as stat left join SMS_StatMsgInsStrings as ins on stat.RecordID = ins.RecordID left join SMS_StatMsgAttributes as att1 on stat.RecordID = att1.RecordID where stat.MessageType = 768 and stat.MessageID >= 30063 and stat.MessageID <= 30065 and stat.Time >= ##PRM:SMS_StatusMessage.Time## order by stat.Time desc |
Additional Audit SCCM Status Message queries to perform further troubleshooting steps.
| Remote Control Activity Initiated at a Specific Site | Audit status messages that track the use of the Remote Control. | select stat.*, ins.*, att1.*, stat.Time from SMS_StatusMessage as stat left join SMS_StatMsgInsStrings as ins on stat.RecordID = ins.RecordID left join SMS_StatMsgAttributes as att1 on stat.RecordID = att1.RecordID where stat.MessageType = 768 and stat.MessageID >= 30069 and stat.MessageID <= 30087 and stat.SiteCode = ##PRM:SMS_StatusMessage.SiteCode## and stat.Time >= ##PRM:SMS_StatusMessage.Time## order by stat.Time desc |
| Remote Control Activity Initiated by a Specific User | Audit status messages that track the use of the Remote Control by a specific user (when prompted, use the form DOMAIN\username). | select stat.*, ins.*, att1.*, att1.AttributeTime from SMS_StatusMessage as stat left join SMS_StatMsgInsStrings as ins on stat.RecordID = ins.RecordID left join SMS_StatMsgAttributes as att1 on stat.RecordID = att1.RecordID inner join SMS_StatMsgAttributes as att2 on stat.RecordID = att2.RecordID where stat.MessageType = 768 and stat.MessageID >= 30069 and stat.MessageID <= 30087 and att2.AttributeID = 403 and att2.AttributeValue = ##PRM:SMS_StatMsgAttributes.AttributeValue## and att2.AttributeTime >= ##PRM:SMS_StatMsgAttributes.AttributeTime## order by att1.AttributeTime desc |
| Remote Control Activity Initiated from a Specific System | Audit status messages that track the use of the Remote Control by users of a specific system. | select stat.*, ins.*, att1.*, stat.Time from SMS_StatusMessage as stat left join SMS_StatMsgInsStrings as ins on stat.RecordID = ins.RecordID left join SMS_StatMsgAttributes as att1 on stat.RecordID = att1.RecordID where stat.MessageType = 768 and stat.MessageID >= 30069 and stat.MessageID <= 30087 and stat.MachineName = ##PRM:SMS_StatusMessage.MachineName## and stat.Time >= ##PRM:SMS_StatusMessage.Time## order by stat.Time desc |
| Remote Control Activity Targeted at a Specific System | Audit status messages that track the use of the Remote Control to remotely administer a specific system. | select stat.*, ins.*, att1.*, stat.Time from SMS_StatusMessage as stat left join SMS_StatMsgInsStrings as ins on stat.RecordID = ins.RecordID left join SMS_StatMsgAttributes as att1 on stat.RecordID = att1.RecordID inner join SMS_StatMsgInsStrings as ins2 on stat.RecordID = ins2.RecordID where stat.MessageType = 768 and stat.MessageID >= 30069 and stat.MessageID <= 30087 and ins2.InsStrIndex = 2 and ins2.InsStrValue = ##PRM:SMS_StatusMessage.MachineName## and stat.Time >= ##PRM:SMS_StatusMessage.Time## order by stat.Time desc |
| Security Roles / Scopes created, modified, or deleted | Audit status messages that track the creation, modification, and deletion of security rights. | select stat.*, ins.*, att1.*, stat.Time from SMS_StatusMessage as stat left join SMS_StatMsgInsStrings as ins on stat.RecordID = ins.RecordID left join SMS_StatMsgAttributes as att1 on stat.RecordID = att1.RecordID where stat.MessageType = 768 and (stat.MessageID >= 31200 and stat.MessageID <= 31202 OR stat.MessageID >= 31220 and stat.MessageID <= 31222 OR stat.MessageID = 31207) and stat.Time >= ##PRM:SMS_StatusMessage.Time## order by stat.Time desc |
| Server Component Configuration Changes | Audit status messages that track changes to the server components” configuration are kept in the site control file. | select stat.*, ins.*, att1.*, stat.Time from SMS_StatusMessage as stat left join SMS_StatMsgInsStrings as ins on stat.RecordID = ins.RecordID left join SMS_StatMsgAttributes as att1 on stat.RecordID = att1.RecordID where stat.MessageType = 768 and ((stat.MessageID >= 30033 and stat.MessageID <= 30035) or (stat.MessageID >= 30039 and stat.MessageID <= 30041)) and stat.Time >= ##PRM:SMS_StatusMessage.Time## order by stat.Time desc |
| Site Addresses Created, Modified, or Deleted | Audit status messages that track the creation, modification, and deletion of site addresses. | select stat.*, ins.*, att1.*, stat.Time from SMS_StatusMessage as stat left join SMS_StatMsgInsStrings as ins on stat.RecordID = ins.RecordID left join SMS_StatMsgAttributes as att1 on stat.RecordID = att1.RecordID where stat.MessageType = 768 and stat.MessageID >= 30018 and stat.MessageID <= 30020 and stat.Time >= ##PRM:SMS_StatusMessage.Time## order by stat.Time desc |
Feedback sent to Microsoft Status Message Queries
If you want to know details about Feedback sent to Microsoft, check out the following Microsoft Feedback Status Message Queries.
I see both the queries are the same? If so, I don’t understand why there is a duplicate query.
| Feedback sent to Microsoft | Configuration Manager feedback sent to Microsoft for this hierarchy. | select stat.*, ins.*, att1.*, stat.Time from SMS_StatusMessage as stat left join SMS_StatMsgInsStrings as ins on ins.RecordID = stat.RecordID left join SMS_StatMsgAttributes as att1 on att1.RecordID = stat.RecordID where stat.Time >= ##PRM:SMS_StatusMessage.Time## and (stat.MessageID = 53900 or stat.MessageID = 53901) order by stat.Time DESC |
| Feedback sent to Microsoft | Configuration Manager feedback sent to Microsoft for this hierarchy. | select stat.*, ins.*, att1.*, stat.Time from SMS_StatusMessage as stat left join SMS_StatMsgInsStrings as ins on stat.RecordID = ins.RecordID left join SMS_StatMsgAttributes as att1 on stat.RecordID = att1.RecordID where stat.Time >= ##PRM:SMS_StatusMessage.Time## and (stat.MessageID = 53900 or stat.MessageID = 53901) order by stat.Time desc |
Status Message Queries are reported by the SMS Server component
SCCM Status message Queries are reported by the SMS Server components. You can check the comments and WQL query to get the Status Message Queries.
| Server Components Experiencing Fatal Errors | Status messages are reported by the SMS Server components when they experience fatal errors. | select stat.*, ins.*, att1.*, stat.Time from SMS_StatusMessage as stat left join SMS_StatMsgInsStrings as ins on stat.RecordID = ins.RecordID left join SMS_StatMsgAttributes as att1 on stat.RecordID = att1.RecordID where stat.ModuleName = ‘SMS Server’ and stat.MessageID = 669 and stat.SiteCode = ##PRM:SMS_StatusMessage.SiteCode## and stat.Time >= ##PRM:SMS_StatusMessage.Time## order by stat.Time desc |
| Server Components Flagged with Warning or Critical Status | Status messages are reported by the SMS Component Status Summarizer when a server component has reported too many status messages. | select stat.*, ins.*, att1.*, stat.Time from SMS_StatusMessage as stat left join SMS_StatMsgInsStrings as ins on stat.RecordID = ins.RecordID left join SMS_StatMsgAttributes as att1 on stat.RecordID = att1.RecordID where stat.Component = ‘SMS_COMPONENT_STATUS_SUMMARIZER’ and ((stat.MessageID >= 4603 and stat.MessageID <= 4605) or (stat.MessageID >= 4608 and stat.MessageID <= 4613)) and stat.Time >= ##PRM:SMS_StatusMessage.Time## order by stat.Time desc |
| Site Systems Flagged with Warning or Critical Status | Status messages are reported by the SMS Site System Status Summarizer when a storage object is inaccessible, low on storage space, or unavailable. | select stat.*, ins.*, att1.*, stat.Time from SMS_StatusMessage as stat left join SMS_StatMsgInsStrings as ins on stat.RecordID = ins.RecordID left join SMS_StatMsgAttributes as att1 on stat.RecordID = att1.RecordID where stat.Component = ‘SMS_SITE_SYSTEM_STATUS_SUMMARIZER’ and stat.MessageID >= 4700 and stat.MessageID <= 4724 and stat.Time >= ##PRM:SMS_StatusMessage.Time## order by stat.Time desc |
Author
Anoop C Nair is Microsoft MVP! He is a Device Management Admin with more than 20 years of experience (calculation done in 2021) in IT. He is Blogger, Speaker, and Local User Group HTMD Community leader. His main focus is on Device Management technologies like SCCM 2012, Current Branch, and Intune. He writes about ConfigMgr, Windows 11, Windows 10, Azure AD, Microsoft Intune, Windows 365, AVD, etc.
Hello, tell me please, is it possible to somehow set up alerting to mail based on the information in Status Message Queries?
for example, to pull a separate host with the deployment status